Account Recovery
Learn how to recover your Expat183 account if you have lost access to your email and all multi-factor authentication methods.
Last reviewed
Before you start: Account recovery is designed for situations where you have lost access to both your email and all MFA methods. If you can still access your email, use the standard password reset instead. It is faster and does not require a cooling-off period.
Recovery Process Step-by-Step
The account recovery process uses your recovery key to verify your identity. It involves several steps designed to balance security with accessibility:
- Enter your email address: Provide the email associated with your Expat183 account. An automated security check runs in the background; you will only be asked to do something if it needs a closer look.
- Enter your recovery key: Input the recovery key you saved when you set up your account or generated in Security Settings. The key is validated using a checksum to ensure accuracy.
- Answer knowledge-based questions: Respond to security questions based on your account activity. These are used as an additional identity verification layer.
- Set a new password: Choose a strong new password for your account. The password must meet our minimum strength requirements. It is the same account on all of our sites, so the new password applies on each of them.
- Wait for the cooling-off period: A 72-hour cooling-off period begins. We notify the account’s registered email and phone, so if the request was not made by you, you can cancel it from that notification before the new password takes effect.
Why Does Recovery Take 72 Hours?
The 72-hour cooling-off period is a critical security measure. It exists to protect you in case someone else gains access to your recovery key and attempts to take over your account.
How the cooling-off period protects you
- You receive email and SMS notifications when a recovery attempt is initiated
- You have 72 hours to cancel the recovery if you did not request it
- An attacker cannot instantly take over your account, so you have time to act
- Sensitive account changes are restricted during the cooling-off period
- Once the period expires without cancellation, your new password becomes active
- If changes to your account were paused after a compromise report, completing recovery lifts that pause and we email you to confirm it
What you can do during the 72-hour wait
- Check the status of your recovery at any time using your attempt ID
- Cancel the recovery if you regain access to your account through other means
- Contact our security team if you need assistance
Bookmark your recovery status page. After starting recovery, you will receive an attempt ID. You can use this to check the status of your recovery at any time by visiting the recovery page with your attempt ID.
What If I Don’t Have a Recovery Key?
If you have not generated a recovery key, the self-service recovery process is not available. However, you still have options:
- Try the standard password reset: if you can access your email, this is the fastest route
- Check if you have backup codes, which let you bypass MFA and sign in with your email
- Contact our security team, who can help verify your identity through alternative means
- Report your account as compromised, which pauses high-risk actions immediately; open the emailed link to fully freeze the account and end all sessions
Prevent this in the future
We strongly recommend generating a recovery key as soon as you regain access to your account. Go to Settings > Security > Recovery Key to set one up. Store it in a password manager or a secure physical location.
Troubleshooting
My recovery key is not accepted
- Ensure you are entering the key exactly as it was displayed, including hyphens
- Recovery keys use Crockford Base32 encoding: the letters I, L, O, and U are not used
- Common mistakes: confusing 0 (zero) with O (letter), or 1 (one) with I or L
- The key includes a checksum character, so if any character is wrong validation will fail
- If you have lost your recovery key, see "What If I Don’t Have a Recovery Key?" above
I did not receive notification emails
- Check your spam or junk folder for emails from noreply@thewill.ai
- If your email is compromised, the attacker may have deleted the notifications
- SMS notifications are sent if you have a phone number registered on your account
- Contact our security team if you are not receiving any notifications
Someone else started a recovery on my account
- Cancel the recovery immediately using the link in your notification email
- If you cannot access your email, use the cancel recovery page with your reference code
- Change your email password as soon as possible
- Report your account as compromised to pause high-risk actions immediately (open the emailed link to fully freeze it)
- Generate a new recovery key after regaining access
Related Resources
Can’t find what you’re looking for?
Our support team is here to help. Contact us and we’ll get back to you as soon as possible.
Contact Support